From nobody@FreeBSD.org  Wed Sep  9 14:34:32 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 1D853106566B
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  9 Sep 2009 14:34:32 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 0B0F68FC08
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  9 Sep 2009 14:34:32 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n89EYVn9000669
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 9 Sep 2009 14:34:31 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n89EYVVb000667;
	Wed, 9 Sep 2009 14:34:31 GMT
	(envelope-from nobody)
Message-Id: <200909091434.n89EYVVb000667@www.freebsd.org>
Date: Wed, 9 Sep 2009 14:34:31 GMT
From: "Vladislav V. Prodan" <universite@ukr.net>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Do not working multicast through igmpproxy 
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         138666
>Category:       kern
>Synopsis:       [multicast] [panic] not working multicast through igmpproxy
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-net
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 09 14:40:01 UTC 2009
>Closed-Date:    Mon Feb 01 13:35:57 UTC 2010
>Last-Modified:  Mon Feb 01 13:35:57 UTC 2010
>Originator:     Vladislav V. Prodan
>Release:        FreeBSD 8.0-BETA4 #0: Wed Sep  9 00:53:41 EEST 2009 amd64
>Organization:
>Environment:
FreeBSD mary-teresa.otrada.od.ua 8.0-BETA4 FreeBSD 8.0-BETA4 #0: Wed Sep  9 00:53:41 EEST 2009     vlad11@mary-teresa.otrada.od.ua:/usr/obj/usr/src/sys/mary-teresa.17  amd64

>Description:
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x20:0xffffffff803fbed5
stack pointer           = 0x28:0xffffff8000041ab0
frame pointer           = 0x28:0xffffff8000041ad0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi4: clock)
trap number             = 9
panic: general protection fault
cpuid = 0
Uptime: 2h38m8s
Physical memory: 6098 MB
Dumping 1653 MB: 1638 1622 1606 1590 1574 1558 1542 1526 1510 1494 1478 1462 1446 1430 1414 1398 1382 1366 1350 1334 1318 1302 1286 1270 1254 1238 1222 1206 1190 1174 1158 1142 1126 1110 1094 1078 1062 1046 1030 1014 998 982 966 950 934 918 902 886 870 854 838 822 806 790 774 758 742 726 710 694 678 662 646 630 614 598 582 566 550 534 518 502 486 470 454 438 422 406 390 374 358 342 326 310 294 278 262 246 230 214 198 182 166 150 134 118 102 86 70 54 38 22 6

Reading symbols from /boot/kernel/zfs.ko...Reading symbols from /boot/kernel/zfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/zfs.ko
Reading symbols from /boot/kernel/opensolaris.ko...Reading symbols from /boot/kernel/opensolaris.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/opensolaris.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/kernel/accf_http.ko...Reading symbols from /boot/kernel/accf_http.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/accf_http.ko
#0  doadump () at pcpu.h:223
223             __asm __volatile("movq %%gs:0,%0" : "=r" (td));
(kgdb) bt
#0  doadump () at pcpu.h:223
#1  0xffffffff803a5219 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:416
#2  0xffffffff803a566c in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:579
#3  0xffffffff8065e30d in trap_fatal (frame=0x9, eva=Variable "eva" is not available.
) at /usr/src/sys/amd64/amd64/trap.c:852
#4  0xffffffff8065ee4a in trap (frame=0xffffff8000041a00) at /usr/src/sys/amd64/amd64/trap.c:639
#5  0xffffffff80645463 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:224
#6  0xffffffff803fbed5 in m_freem (mb=0xc9e5894807b70f55) at /usr/src/sys/kern/uipc_mbuf.c:160
#7  0xffffffff804d9e92 in expire_mfc (rt=0xffffff01420d4b00) at /usr/src/sys/netinet/ip_mroute.c:1031
#8  0xffffffff804db344 in expire_upcalls (unused=Variable "unused" is not available.
) at /usr/src/sys/netinet/ip_mroute.c:1457
#9  0xffffffff803b7dc1 in softclock (arg=Variable "arg" is not available.
) at /usr/src/sys/kern/kern_timeout.c:411
#10 0xffffffff8037f380 in intr_event_execute_handlers (p=Variable "p" is not available.
) at /usr/src/sys/kern/kern_intr.c:1165
#11 0xffffffff803808fe in ithread_loop (arg=0xffffff0001392660) at /usr/src/sys/kern/kern_intr.c:1178
#12 0xffffffff8037d387 in fork_exit (callout=0xffffffff80380870 <ithread_loop>, arg=0xffffff0001392660,
    frame=0xffffff8000041c80) at /usr/src/sys/kern/kern_fork.c:843
#13 0xffffffff8064593e in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:561
#14 0x0000000000000000 in ?? ()
#15 0x0000000000000000 in ?? ()
#16 0x0000000000000001 in ?? ()
#17 0x0000000000000000 in ?? ()
#18 0x0000000000000000 in ?? ()
#19 0x0000000000000000 in ?? ()
#20 0x0000000000000000 in ?? ()
#21 0x0000000000000000 in ?? ()
#22 0x0000000000000000 in ?? ()
#23 0x0000000000000000 in ?? ()
#24 0x0000000000000000 in ?? ()
#25 0x0000000000000000 in ?? ()
#26 0x0000000000000000 in ?? ()
#27 0x0000000000000000 in ?? ()
#28 0x0000000000000000 in ?? ()
#29 0x0000000000000000 in ?? ()
---Type <return> to continue, or q <return> to quit---
#30 0x0000000000000000 in ?? ()
#31 0x0000000000000000 in ?? ()
#32 0x0000000000000000 in ?? ()
#33 0x0000000000000000 in ?? ()
#34 0x0000000000000000 in ?? ()
#35 0x0000000000000000 in ?? ()
#36 0x0000000000000000 in ?? ()
#37 0x0000000000000000 in ?? ()
#38 0x0000000000c6d000 in ?? ()
#39 0x000000000000000b in ?? ()
#40 0xffffffff808cf500 in affinity ()
#41 0xffffffff808cf500 in affinity ()
#42 0xffffff000150d720 in ?? ()
#43 0xffffff8000041240 in ?? ()
#44 0xffffff80000411f8 in ?? ()
#45 0xffffff00013a7390 in ?? ()
#46 0xffffffff803c8159 in sched_switch (td=0xffffff0001392660, newtd=0xffffffff80380870, flags=Variable "flags" is not available.
)
    at /usr/src/sys/kern/sched_ule.c:1858
Previous frame inner to this frame (corrupt stack?)


Igmpproxy (/usr/ports/net/igmpproxy) logs:

Sep  9 16:56:18 mary-teresa igmpproxy: Debu: Packet from 10.0.0.1: proto: 2 hdrlen: 24 iplen: 8 or 2048
Sep  9 16:56:18 mary-teresa igmpproxy: Note: RECV V2 member report   from 10.0.0.1        to 224.0.0.2 (ip_hl 24, data 8)
Sep  9 16:56:18 mary-teresa igmpproxy: Note: The IGMP message was from myself. Ignoring.
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: Packet from 10.0.0.10: proto: 2 hdrlen: 24 iplen: 8 or 2048
Sep  9 16:56:19 mary-teresa igmpproxy: Note: RECV Leave message      from 10.0.0.10       to 224.0.0.2 (ip_hl 24, data 8)
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: Got leave message from 10.0.0.10 to 239.0.1.41. Starting last member detection.
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: SENT Membership query   from 10.0.0.1        to 239.0.1.41
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: Sent membership query from 10.0.0.1 to 239.0.1.41. Delay: 10
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: Created timeout 14 (#1) - delay 4 secs
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: (Id:12, Time:6)
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: (Id:14, Time:4)
Sep  9 16:56:19 mary-teresa igmpproxy: Debu: (Id:13, Time:111)
Sep  9 16:56:24 mary-teresa igmpproxy: Debu: About to call timeout 12 (#0)
Sep  9 16:56:24 mary-teresa igmpproxy: Debu: Aging routes in table.
Sep  9 16:56:24 mary-teresa igmpproxy: Debu:  Current routing table (Age active routes); -----------------------------------------------------
Sep  9 16:56:24 mary-teresa igmpproxy: Debu: No routes in table...
Sep  9 16:56:24 mary-teresa igmpproxy: Debu:  -----------------------------------------------------
Sep  9 16:56:28 mary-teresa igmpproxy: Debu: About to call timeout 14 (#0)
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: Route activate request from 10.0.0.10 to 239.192.152.143, downIf -1
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: No table entry for 239.192.152.143 [From: 10.0.0.10]. Inserting route.
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: No existing route for 239.192.152.143. Create new.
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: No routes in table. Insert at beginning.
Sep  9 16:56:32 mary-teresa igmpproxy: Info: Inserted route table entry for 239.192.152.143 on VIF #-1
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: No downstream listeners for group 239.192.152.143. No join sent.
Sep  9 16:56:32 mary-teresa igmpproxy: Debu:  Current routing table (Insert Route); -----------------------------------------------------
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: #0: Dst: 239.192.152.143, Age:2, St: I, OutVifs: 0x00000000
Sep  9 16:56:32 mary-teresa igmpproxy: Debu:  -----------------------------------------------------
Sep  9 16:56:32 mary-teresa igmpproxy: Note: New origin for route 239.192.152.143 is 10.0.0.10, flood -1
Sep  9 16:56:32 mary-teresa igmpproxy: Debu:  Current routing table (Activate Route); -----------------------------------------------------
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: #0: Dst: 239.192.152.143, Age:2, St: A, OutVifs: 0x00000000
Sep  9 16:56:32 mary-teresa igmpproxy: Debu: #0: Origin: 10.0.0.10 floodIf -1 pktcnt 0
Sep  9 16:56:32 mary-teresa igmpproxy: Debu:  -----------------------------------------------------

239.192.152.143 - multicast TV
10.0.0.1 - freebsd, local network interface
10.0.0.10 - windows XP, running TV-player

kernel mrouting included:
options         MROUTING                # Multicast routing


>How-To-Repeat:

1\ install Igmpproxy (/usr/ports/net/igmpproxy)
2\ run Igmpproxy 
3\ a couple of times to switch channels 
4\ after 5 minutes will be a stable kernel panic

I suspect the problem in the routes, both for work with local interfaces, and for multicast.
>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Wed Sep 9 19:19:45 UTC 2009 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=138666 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/138666: commit references a PR
Date: Sun, 13 Sep 2009 01:00:39 +0000 (UTC)

 Author: bms
 Date: Sun Sep 13 01:00:24 2009
 New Revision: 197148
 URL: http://svn.freebsd.org/changeset/base/197148
 
 Log:
   In expire_mfc(), add an assert on the multicast forwarding cache mutex.
   
   PR:		138666
 
 Modified:
   head/sys/netinet/ip_mroute.c
 
 Modified: head/sys/netinet/ip_mroute.c
 ==============================================================================
 --- head/sys/netinet/ip_mroute.c	Sat Sep 12 23:01:36 2009	(r197147)
 +++ head/sys/netinet/ip_mroute.c	Sun Sep 13 01:00:24 2009	(r197148)
 @@ -1025,6 +1025,8 @@ expire_mfc(struct mfc *rt)
  {
  	struct rtdetq *rte, *nrte;
  
 +	MFC_LOCK_ASSERT();
 +
  	free_bw_list(rt->mfc_bw_meter);
  
  	TAILQ_FOREACH_SAFE(rte, &rt->mfc_stall, rte_link, nrte) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: Bruce Simpson <bms@incunabulum.net>
To: freebsd-gnats-submit@FreeBSD.org
Cc: freebsd-net@FreeBSD.org
Subject: Re: kern/138666: [multicast] [panic] not working multicast through
 igmpproxy
Date: Sun, 13 Sep 2009 02:04:52 +0100

 I did a quick pass over ip_mroute.c to see if I could have introduced 
 any obvious errors during refactoring; didn't see anything obvious.
 
 The backtrace which was posted points towards a trashed rte->m pointer, 
 assuming it's accurate and the arguments didn't get trashed on-stack. 
 The MFC lock should be held in expire_mfc(). I'll add a lock assertion 
 there for now. The VIF lock shouldn't be needed in this path.
State-Changed-From-To: open->feedback 
State-Changed-By: bms 
State-Changed-When: Tue 29 Sep 2009 06:15:33 UTC 
State-Changed-Why:  
Based on backtrace, it's difficult to say what the problem could be. 
ENOTIME to attempt reproducing the condition. Initial testing around 
the time of the last commits to ip_mroute.c didn't expose any problems, 
have you checked out the memory on the affected machine? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=138666 

From: "Vladislav V. Prodan" <universite@ukr.net>
To: bug-followup@FreeBSD.org
Cc: universite@ukr.net
Subject: Re: kern/138666: [multicast] [panic] not working multicast through
 igmpproxy
Date: Fri, 02 Oct 2009 00:31:39 +0300

 Memtest86 + v2.01 said that with memory so good.
 
 P.S. Hynix 2Gb + Hynix 2Gb + Aeneon 1Gb + Aeneon 1Gb

From: Andriy Syrovenko <andriys@gmail.com>
To: bug-followup@freebsd.org, universite@ukr.net
Cc:  
Subject: Re: kern/138666: [multicast] [panic] not working multicast through 
	igmpproxy
Date: Mon, 7 Dec 2009 11:56:11 +0200

 I'd like to confirm the problem exists and I can reproduce it easily.
 The stack trace is completely identical to the initially submitted
 one.
 Tested with igmpproxy from ports (0.1 beta2) as well as with the fresh
 version from sourceforge, with absolutely the same result.
 Steps required to reproduce:
 
 1. Start igmpproxy
 2. Send igmp report query (probably this step is optional)
 3. Wait for several minutes for the kernel crash to occur
 
 I'd love to help in investigating and debugging the issue if someone
 points me in the right direction.
 
 My system is:
 
 FreeBSD venus 8.0-RELEASE-p1 FreeBSD 8.0-RELEASE-p1 #0: Fri Dec=A0 4
 10:03:09 EET 2009=A0=A0=A0=A0 root@mybsd:/usr/obj/usr/src/sys/ROUTER=A0 amd=
 64
 
 Kernel configuration is:
 
 include=A0=A0=A0=A0=A0=A0=A0=A0 GENERIC
 ident=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 ROUTER
 options=A0=A0=A0=A0=A0=A0=A0=A0 DEVICE_POLLING
 options=A0=A0=A0=A0=A0=A0=A0=A0 HZ=3D1000
 options=A0=A0=A0=A0=A0=A0=A0=A0 ALTQ
 options=A0=A0=A0=A0=A0=A0=A0=A0 ALTQ_CBQ
 options=A0=A0=A0=A0=A0=A0=A0=A0 ALTQ_RED
 options=A0=A0=A0=A0=A0=A0=A0=A0 ALTQ_RIO
 options=A0=A0=A0=A0=A0=A0=A0=A0 ALTQ_HFSC
 options=A0=A0=A0=A0=A0=A0=A0=A0 ALTQ_PRIQ
 options=A0=A0=A0=A0=A0=A0=A0=A0 MROUTING
State-Changed-From-To: feedback->closed 
State-Changed-By: bms 
State-Changed-When: Mon 1 Feb 2010 13:34:31 UTC 
State-Changed-Why:  
should be resolved by svn rev 201254 on HEAD, 201515 on stable/8 

http://www.freebsd.org/cgi/query-pr.cgi?pr=138666 
>Unformatted:
